With ConSentry's LANShield appliance, enterprises gain new control over network access without new switches or sluggish software solutions

Traditionally, enterprise networks have been built on trust: Anyone connected is assumed to be authorized because they have to be on the premises. But the growing prevalence of wireless networks, remote access, and nonstaff workers have turned networks into easy targets. "The LAN is now the new DMZ," says Tom Barsi, CEO of ConSentry.

You could replace all your switches with ones that include an authentication mechanism such as 802.1x. But that's costly. Another option is to use overlay control software to monitor the network and authenticate users as they try to access resources. "But that software is not designed for high-speed networking," Barsi says. "You've got to do this at LAN speeds."

ConSentry approaches the authentication issue from a new angle. Its LANShield appliance sits right behind the existing intrusion detection system, connected via a bridge that allows it to perform deep packet analysis and inspect traffic all the way to the application layer, even on 10Gbps networks, without requiring new switches ''" although ConSentry also offers its technology embedded in a switch for customers upgrading their switches anyhow.

ConSentry has automated many functions, including some not available in standard 802.1x. For example, to ensure that desktop systems don't contain threats that could enter the network, the ConSentry devices can issue temporary agents to scan for known threats, anti-virus definition, service packs, and custom registry keys and files. This frees IT from having to load and manage agents on each desktop.